Login Request a demo
AD
Product
Apache Druid
by Apache Software Foundation · last CVE Feb 10, 2026
7
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 2High 0Medium 5Low 0
Severity
All severities7Critical2High0Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Druid to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-23906
9.8
1%
Feb 10
Apache Druid: Authentication Bypass via LDAP Anonymous Bind
Affected: 0.17.0 before 36.0.0
CVE-2025-59390
9.8
1%
Nov 26
Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
Affected: through 34.0.0
CVE-2024-45537
6.5
1%
Sep 17
Apache Druid: Users can provide MySQL JDBC properties not on allow list
Affected: through 30.0.0
CVE-2021-44791
6.1
2%
Jul 7
Reflected XSS on certain HTTP endpoints
Affected: Apache Druid through 0.22.1
CVE-2025-27888
5.4
2%
Mar 20
Apache Druid: Server-Side Request Forgery and Cross-Site Scripting
Affected: before 31.0.2; 32.0.0
CVE-2024-45384
5.3
1%
Sep 17
Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack
Affected: 0.18.0 through 30.0.0
CVE-2022-28889
4.3
2%
Jul 7
Clickjacking in the web console
Affected: through 0.22.1
Showing 7